CVE-2026-39537: WordPress Mikado Core plugin <= 1.6 - Local File Inclusion vulnerability

Synopsis

An unauthenticated local file inclusion vulnerability affects the Mikado Core WordPress plugin at version 1.6 and earlier. It is reachable over the network and requires no login, though exploitation involves elevated attack complexity. Successful exploitation gives an attacker full read access to files on the server, the ability to tamper with data, and can result in remote code execution depending on available server-side files. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, meaning an attacker must be able to reach the WordPress installation via HTTP or HTTPS from a remote location.

• AuthenticationNot required

  No account or session credentials are needed; the attacker can trigger the vulnerability as an anonymous visitor.

• Victim interactionNot required

  Exploitation is fully server-side and does not require any action from an administrator or other user.

• Attack complexityDetail

  Attack complexity is rated HIGH, meaning the attacker must navigate race conditions, specific server configurations, or other environmental factors to reliably achieve inclusion of a target file.

Blast Radius

• An attacker can read arbitrary files on the server filesystem, including WordPress configuration files that contain database credentials and secret keys.
• An attacker can read application source code and environment files, exposing API tokens and integration secrets stored on disk.
• Where server configuration permits, an attacker can include and execute a server-side file to achieve remote code execution, allowing arbitrary command execution on the host.
• Successful exploitation can lead to full integrity compromise of the WordPress application, including modification of content, users, and settings.